@wildo-ai/saas-backend-lib 1.1.12 → 1.1.13

package/dist/esm/compliance/approval-seals/approval-seals-on-record.backend.controller.d.ts

@@ -0,0 +1,90 @@
+import { LoggerService } from '../../monitoring/logger/services/logger.service';
+import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service';
+import { ErrorHandlerService } from '../../errors/services/error-handler.backend.service';
+import { AbstractControllerBackendService } from '../../base-classes/services/controllers/abstract-controller.backend.service';
+import { RepositoriesRegistryHandlerBackendService } from '../../base-classes/services/repositories/repositories-registry-handler.backend.service';
+import type { ResourcesRegistryBackendService } from '../../resources/services/resources-registry.backend.service';
+import type { ExecutionContextCreatorBackendService } from '../../runtime/services/execution-context-creator.backend.service';
+import type { AuthorizationsBackendService } from '../../security/authorizations/services/authorizations.backend.service';
+import type { SystemAccessBackendService } from '../../base-classes/services/services/system-access.backend.service';
+import type { FilesBackendService } from '../../files/services/files.backend.service';
+import type { AppConfigurationService } from '../../config/services/app-configuration.backend.service';
+import type { FileFieldDetectionBackendService } from '../../files/services/file-field-detection.backend.service';
+export declare class ApprovalSealsOnRecordControllerBackendService extends AbstractControllerBackendService {
+    private readonly repositoriesRegistry;
+    private readonly resourcesRegistry;
+    private readonly executionContextCreator;
+    private readonly authorizationsService;
+    /** The currency check reads the record as the system, as the operator's door does, so both compare the same values. */
+    private readonly systemAccess?;
+    /** A presentation moved to a frozen file, and the manifested copy, are read through the files service. */
+    private readonly files?;
+    private readonly appConfig?;
+    /** A file's view admits its reader through the files door's own check of the field the file is in. */
+    private readonly fileFieldDetection?;
+    private readonly store;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, errorHandler: ErrorHandlerService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService, resourcesRegistry: ResourcesRegistryBackendService, executionContextCreator: ExecutionContextCreatorBackendService, authorizationsService: AuthorizationsBackendService, 
+    /** The currency check reads the record as the system, as the operator's door does, so both compare the same values. */
+    systemAccess?: Pick<SystemAccessBackendService, 'readAsSystem'>, 
+    /** A presentation moved to a frozen file, and the manifested copy, are read through the files service. */
+    files?: Pick<FilesBackendService, 'readFileBytes'>, appConfig?: Pick<AppConfigurationService, 'config' | 'isInitialized'>, 
+    /** A file's view admits its reader through the files door's own check of the field the file is in. */
+    fileFieldDetection?: FileFieldDetectionBackendService);
+    protected setupRoutes(): void;
+    /** GET …/:field — the record's view of the seal it stores. */
+    private handleView;
+    /** GET …/:field/manifested-copy — the copy, checked against its recorded hash before a byte leaves. */
+    private handleManifestedCopy;
+    /**
+     * GET /approval-seals/files/:fileId — the seal that attests a file (#2913): the deliverable a person approved by its hash.
+     * Without currency, which is a statement about the record the approval is about, and which a reader of the file may not
+     * be able to read.
+     */
+    private handleFileView;
+    /** GET /approval-seals/files/:fileId/manifested-copy — that file's manifested copy. */
+    private handleFileManifestedCopy;
+    /**
+     * GET /approval-seals/decisions/:decisionRef — the seal of the signed-in person's own answer to a decision (#2913). The
+     * person who decided may always see the seal of their act (it is in their subject export); nobody else is answered.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a decision's seal is answered to the person who decided, and to nobody else through this door.
+     */
+    private handleDecisionView;
+    /** What a reader is told about one seal: its successor, its currency when asked for, its copy, its public check. */
+    private viewOf;
+    /** Send a SEALED seal's manifested copy, checked against its recorded hash before a byte leaves. */
+    private sendManifestedCopy;
+    /**
+     * Find the seal, check it is about the record the request names, and admit the caller through that record's READ, the
+     * record's field holding the seal's id. Every refusal is the same 404.
+     */
+    private admit;
+    /**
+     * The seal that attests a file and that its own record still names, then the caller admitted through the READ of the
+     * record the FILE belongs to (`authorizeFileParentRead`, over `authorizeRecordReadAsCaller`). A live seal first, latest
+     * decision first; then one its approver's erasure retained, known by id and subject only. A seal its record does not
+     * name (an approved effect that failed) is passed over. Every refusal is the same 404, the files door's.
+     */
+    private admitFile;
+    private attestingSealOf;
+    /**
+     * Whether the record a seal is about names it: the consumer stores a seal's id when the approved effect happens (a
+     * close's `signOffApprovalSealId`, or the reopening that set it aside), so a seal no field of its record names approved
+     * nothing that took effect. Read as the system; nothing of the record leaves.
+     */
+    private recordNamesSeal;
+    private fileNotFound;
+    /** Whether the registry knows a resource type, asked without letting an unknown name throw a 500. */
+    private resourceIsRegistered;
+    /**
+     * The approval's currency over its record (#2914), as the operator's door computes it. Undefined when it cannot be
+     * asked here (the presentation cannot be read, or no system access is bound): the view then says nothing about
+     * currency, which is never read as current.
+     */
+    private currencyOf;
+    /** The `files` row of the copy a seal names, when it is linked to the seal and servable; null otherwise. */
+    private servableCopyRow;
+    private manifestedCopyServable;
+    private notFound;
+}
+//# sourceMappingURL=approval-seals-on-record.backend.controller.d.ts.map

package/dist/esm/compliance/approval-seals/approval-seals-on-record.backend.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seals-on-record.backend.controller.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seals-on-record.backend.controller.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AACnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAIpH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AA6C/H,qBACa,6CAA8C,SAAQ,gCAAgC;IAOhC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxD,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACxF,uHAAuH;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC1F,0GAA0G;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IACpF,sGAAsG;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAhBxG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;gBAGV,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACD,oBAAoB,EAAE,yCAAyC,EAC1E,iBAAiB,EAAE,+BAA+B,EACpC,uBAAuB,EAAE,qCAAqC,EAC9E,qBAAqB,EAAE,4BAA4B;IACtH,uHAAuH;IAC1C,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,cAAc,CAAC;IAC5I,0GAA0G;IAC7B,KAAK,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,EACrD,SAAS,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,eAAe,CAAC;IAC/I,sGAAsG;IACnB,kBAAkB,CAAC,EAAE,gCAAgC;IAM1I,SAAS,CAAC,WAAW,IAAI,IAAI;IAQ7B,8DAA8D;YAChD,UAAU;IAOxB,uGAAuG;YACzF,oBAAoB;IAKlC;;;;OAIG;YACW,cAAc;IAO5B,uFAAuF;YACzE,wBAAwB;IAKtC;;;;;OAKG;YACW,kBAAkB;IAehC,oHAAoH;YACtG,MAAM;IAmBpB,oGAAoG;YACtF,kBAAkB;IAoBhC;;;OAGG;YACW,KAAK;IA6BnB;;;;;OAKG;YACW,SAAS;YAmBT,eAAe;IAY7B;;;;OAIG;YACW,eAAe;IAO7B,OAAO,CAAC,YAAY;IAMpB,qGAAqG;IACrG,OAAO,CAAC,oBAAoB;IAQ5B;;;;OAIG;YACW,UAAU;IA0BxB,4GAA4G;YAC9F,eAAe;YAQf,sBAAsB;IAIpC,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/esm/compliance/approval-seals/approval-seals-on-record.backend.controller.js

@@ -0,0 +1,373 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+/**
+ * # The record's view of its approval seal (#2913)
+ *
+ * - `GET /approval-seals/:sealId/records/:resourceType/:resourceId/:field` → how the record shows the seal its `field`
+ *   stores: who approved, when, with which meaning, whether it is still current over the record, its deliverable.
+ * - `…/manifested-copy` → the deliverable's manifested copy (#2907), as a PDF.
+ * - `GET /approval-seals/files/:fileId` (+ `/manifested-copy`) → the seal that attests a FILE, the deliverable a person
+ *   approved by its hash: admitted through the READ of the record the file belongs to (the files door's own
+ *   `authorizeFileParentRead`, itself `authorizeRecordReadAsCaller`), and only for a seal its own record still names.
+ * - `GET /approval-seals/decisions/:decisionRef` → the seal of the signed-in person's own answer to a decision, for the
+ *   decision cards and the inbox: the decider reads the seal of their act, nobody else.
+ *
+ * ## Who is admitted, and to what
+ *
+ * Exactly the callers the RECORD's own READ operation admits, with their own credentials, through the routes that
+ * operation declares (`authorizeRecordReadAsCaller`, the admission a file in a record's field already uses). On top of
+ * that, three facts must hold, and any that does not answers the same 404 as a record that does not exist:
+ *
+ * 1. the record's `field` holds the seal's id: a seal is shown only where the consumer stored it, which it does when the
+ *    approved effect happened, so a seal whose effect failed (a close that moved while it was being signed) never reads
+ *    as approving the record;
+ * 2. the seal is ABOUT that record (`linkedResourceType` / `linkedResourceId`): a field cannot be pointed at another
+ *    record's seal;
+ * 3. for the copy, the seal still owns a servable copy whose bytes match the hash recorded for them.
+ *
+ * Read-only, and nothing is recorded on the trail: the view hands the record's reader the approver's printed name, which
+ * a record that stores a decider (`closes.signedOffByUserId`) already shows them, and the record's own READ is the
+ * access decision. Currency names fields, never values.
+ *
+ * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — the person's approval of a record is shown where the record is read, with whether it still describes the record, computed from the seal, never assumed.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a seal is shown only to a caller the record's own READ admits, and only for the seal that record stores.
+ */
+import { createHash } from 'crypto';
+import { injectable, inject, optional } from 'inversify';
+import { ApprovalSealOfDecisionParamsSchema, ApprovalSealOnFileParamsSchema, ApprovalSealOnRecordParamsSchema, ApprovalSealStatus, BackendApiType, ErrorCustomMessageReference, ErrorType, FILE_DOWNLOADABLE_STATUSES, HttpMethod, ManualControllerRouteKey, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { LoggerService } from '../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
+import { ErrorHandlerService } from '../../errors/services/error-handler.backend.service.js';
+import { AbstractControllerBackendService } from '../../base-classes/services/controllers/abstract-controller.backend.service.js';
+import { RepositoriesRegistryHandlerBackendService } from '../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
+import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
+import { authorizeFileParentRead, authorizeRecordReadAsCaller } from '../../files/utils/file-parent-read-context.backend.js';
+import { createFileShareBinding } from '../../files/utils/file-share-binding.backend.js';
+import { ApprovalSealRelayStore } from './approval-seal-relay-store.backend.js';
+import { assessApprovalSealCurrency } from './approval-seal-currency.backend.js';
+import { ApprovalSealPresentationReadOutcome, readApprovalSealPresentation } from './approval-seal-presentation-read.backend.js';
+import { approvalSealPublicCheckUrlOf } from './approval-seal-public-check.backend.js';
+import { approvalSealOnRecordViewOf } from './approval-seal-on-record.backend.js';
+/** A stored id as a string: ids are strings in SQL and ObjectIds in Mongo, and a populated object is never an id. */
+function storedIdOf(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object' && 'toHexString' in value && typeof value.toHexString === 'function') {
+        return value.toHexString();
+    }
+    return undefined;
+}
+/**
+ * How deep in a record a seal's id is looked for: a top-level field (`signOffApprovalSealId`), or a member of an entry of
+ * a top-level array (`reopenings[].previousSignOffApprovalSealId`). Bounded, so a record's size bounds the search.
+ */
+const RECORD_SEAL_REFERENCE_DEPTH = 2;
+/** Whether a stored value names `id`, within `depth` levels of objects and arrays. */
+function valueNamesId(value, id, depth) {
+    if (storedIdOf(value) === id)
+        return true;
+    if (depth <= 0 || value === null || typeof value !== 'object' || value instanceof Date)
+        return false;
+    const members = Array.isArray(value) ? value : Object.values(value);
+    return members.some((member) => valueNamesId(member, id, Array.isArray(value) ? depth : depth - 1));
+}
+let ApprovalSealsOnRecordControllerBackendService = class ApprovalSealsOnRecordControllerBackendService extends AbstractControllerBackendService {
+    repositoriesRegistry;
+    resourcesRegistry;
+    executionContextCreator;
+    authorizationsService;
+    systemAccess;
+    files;
+    appConfig;
+    fileFieldDetection;
+    store;
+    constructor(logger, errorBuilder, errorHandler, repositoriesRegistry, resourcesRegistry, executionContextCreator, authorizationsService, systemAccess, files, appConfig, fileFieldDetection) {
+        super(logger, errorBuilder, errorHandler, 'ApprovalSealsOnRecordController');
+        this.repositoriesRegistry = repositoriesRegistry;
+        this.resourcesRegistry = resourcesRegistry;
+        this.executionContextCreator = executionContextCreator;
+        this.authorizationsService = authorizationsService;
+        this.systemAccess = systemAccess;
+        this.files = files;
+        this.appConfig = appConfig;
+        this.fileFieldDetection = fileFieldDetection;
+        this.store = new ApprovalSealRelayStore(repositoriesRegistry);
+    }
+    setupRoutes() {
+        this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_RECORD, HttpMethod.GET, (req, res) => this.handleView(req, res));
+        this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_RECORD_MANIFESTED_COPY, HttpMethod.GET, (req, res) => this.handleManifestedCopy(req, res));
+        this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_FILE, HttpMethod.GET, (req, res) => this.handleFileView(req, res));
+        this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_FILE_MANIFESTED_COPY, HttpMethod.GET, (req, res) => this.handleFileManifestedCopy(req, res));
+        this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_OF_DECISION, HttpMethod.GET, (req, res) => this.handleDecisionView(req, res));
+    }
+    /** GET …/:field — the record's view of the seal it stores. */
+    async handleView(req, res) {
+        const { params, seal, retained } = await this.admit(req);
+        const view = await this.viewOf(params.sealId, seal, retained, { resourceType: params.resourceType, resourceId: params.resourceId }, true);
+        res.set('Cache-Control', 'no-store');
+        res.json(view);
+    }
+    /** GET …/:field/manifested-copy — the copy, checked against its recorded hash before a byte leaves. */
+    async handleManifestedCopy(req, res) {
+        const { params, seal } = await this.admit(req);
+        await this.sendManifestedCopy(seal, res, () => this.notFound(params, 'approval_seal_manifested_copy_not_servable'));
+    }
+    /**
+     * GET /approval-seals/files/:fileId — the seal that attests a file (#2913): the deliverable a person approved by its hash.
+     * Without currency, which is a statement about the record the approval is about, and which a reader of the file may not
+     * be able to read.
+     */
+    async handleFileView(req, res) {
+        const { found } = await this.admitFile(req);
+        const view = await this.viewOf(found.sealId, found.seal, found.seal === null, found.subject, false);
+        res.set('Cache-Control', 'no-store');
+        res.json(view);
+    }
+    /** GET /approval-seals/files/:fileId/manifested-copy — that file's manifested copy. */
+    async handleFileManifestedCopy(req, res) {
+        const { fileId, found } = await this.admitFile(req);
+        await this.sendManifestedCopy(found.seal, res, () => this.fileNotFound(fileId));
+    }
+    /**
+     * GET /approval-seals/decisions/:decisionRef — the seal of the signed-in person's own answer to a decision (#2913). The
+     * person who decided may always see the seal of their act (it is in their subject export); nobody else is answered.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a decision's seal is answered to the person who decided, and to nobody else through this door.
+     */
+    async handleDecisionView(req, res) {
+        const { decisionRef } = ApprovalSealOfDecisionParamsSchema.parse(req.params);
+        const executionContext = await this.executionContextCreator.createExecutionContextForManualController(req);
+        const userId = executionContext.initiatorIds?.userId;
+        const notFound = () => this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.NOT_FOUND, context: { reason: 'approval_seal_of_decision_not_found', decisionRef },
+        });
+        if (!userId)
+            throw notFound();
+        const seal = await this.store.latestOfDecisionBy(decisionRef, userId);
+        if (!seal)
+            throw notFound();
+        const view = await this.viewOf(seal._id, seal, false, { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId }, true);
+        res.set('Cache-Control', 'no-store');
+        res.json(view);
+    }
+    /** What a reader is told about one seal: its successor, its currency when asked for, its copy, its public check. */
+    async viewOf(sealId, seal, retained, subject, withCurrency) {
+        const successor = seal ? await this.store.successorOf(sealId, subject) : null;
+        const currency = seal && withCurrency ? await this.currencyOf(seal) : undefined;
+        const manifestedCopyServable = seal ? await this.manifestedCopyServable(seal) : false;
+        const publicCheckUrl = approvalSealPublicCheckUrlOf(this.appConfig?.isInitialized()
+            ? this.appConfig.config.runtime?.endPoints?.[BackendApiType.MAIN_BACKEND_API]?.publicUrl
+            : undefined);
+        return approvalSealOnRecordViewOf({
+            sealId, seal, retained, successor, manifestedCopyServable,
+            ...(currency ? { currency } : {}), ...(publicCheckUrl ? { publicCheckUrl } : {}),
+        });
+    }
+    /** Send a SEALED seal's manifested copy, checked against its recorded hash before a byte leaves. */
+    async sendManifestedCopy(seal, res, notFound) {
+        if (!seal || seal.status !== ApprovalSealStatus.SEALED || !this.files)
+            throw notFound();
+        const fileRow = await this.servableCopyRow(seal);
+        if (!fileRow)
+            throw notFound();
+        const context = await this.executionContextCreator.createForInternalSystemOperation();
+        const bytes = await this.files.readFileBytes(fileRow, context);
+        const recorded = typeof fileRow.contentSha256 === 'string' ? fileRow.contentSha256 : undefined;
+        if (!recorded || createHash('sha256').update(bytes).digest('hex') !== recorded) {
+            this.logger.error('[ApprovalSeals] A manifested copy does not match the hash recorded for it; it is not served', { sealId: seal._id, fileId: fileRow.fileId });
+            throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CONFLICT, context: { reason: 'approval_seal_manifested_copy_mismatch', sealId: seal._id },
+            });
+        }
+        res.setHeader('Content-Type', 'application/pdf');
+        res.setHeader('Content-Disposition', `attachment; filename="approval-${seal._id}.pdf"`);
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.end(bytes);
+    }
+    /**
+     * Find the seal, check it is about the record the request names, and admit the caller through that record's READ, the
+     * record's field holding the seal's id. Every refusal is the same 404.
+     */
+    async admit(req) {
+        const params = ApprovalSealOnRecordParamsSchema.parse(req.params);
+        const notFound = () => this.notFound(params, 'approval_seal_not_shown_on_record');
+        const seal = await this.store.read(params.sealId);
+        const subject = seal
+            ? { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId }
+            : await this.store.retainedSubjectOf(params.sealId);
+        if (!subject || subject.resourceType !== params.resourceType || subject.resourceId !== params.resourceId)
+            throw notFound();
+        const resourceType = params.resourceType;
+        if (!this.resourceIsRegistered(resourceType))
+            throw notFound();
+        const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType);
+        // The scope the record lives in, from the record itself: it only shapes the routes its READ is tried through.
+        const located = await this.repositoriesRegistry.readUnscopedByKey(resourceType, { _id: params.resourceId });
+        if (!located)
+            throw notFound();
+        const primaryScope = configuration.resourcePrimaryScope;
+        await authorizeRecordReadAsCaller(req, {
+            resourceType: params.resourceType,
+            resourceId: params.resourceId,
+            primaryScope,
+            applicationId: storedIdOf(located.applicationId) ?? (seal ? String(seal.applicationId) : ''),
+            organizationId: storedIdOf(located.organizationId) ?? null,
+            userId: storedIdOf(located.userId) ?? null,
+        }, (row) => storedIdOf(row[params.field]) === params.sealId, {
+            resourcesRegistry: this.resourcesRegistry, repositoriesRegistry: this.repositoriesRegistry,
+            executionContextCreator: this.executionContextCreator, authorizationsService: this.authorizationsService,
+        }, notFound);
+        return { params, seal, retained: !seal };
+    }
+    /**
+     * The seal that attests a file and that its own record still names, then the caller admitted through the READ of the
+     * record the FILE belongs to (`authorizeFileParentRead`, over `authorizeRecordReadAsCaller`). A live seal first, latest
+     * decision first; then one its approver's erasure retained, known by id and subject only. A seal its record does not
+     * name (an approved effect that failed) is passed over. Every refusal is the same 404, the files door's.
+     */
+    async admitFile(req) {
+        const { fileId } = ApprovalSealOnFileParamsSchema.parse(req.params);
+        const found = await this.attestingSealOf(fileId);
+        if (!found || !this.fileFieldDetection)
+            throw this.fileNotFound(fileId);
+        const fileRow = await this.store.readFile(fileId);
+        let binding;
+        try {
+            binding = createFileShareBinding(fileRow);
+        }
+        catch {
+            throw this.fileNotFound(fileId);
+        }
+        await authorizeFileParentRead(req, binding, {
+            resourcesRegistry: this.resourcesRegistry, repositoriesRegistry: this.repositoriesRegistry,
+            executionContextCreator: this.executionContextCreator, authorizationsService: this.authorizationsService,
+            errorBuilder: this.errorBuilder, fileFieldDetection: this.fileFieldDetection,
+        });
+        return { fileId, found };
+    }
+    async attestingSealOf(fileId) {
+        for (const seal of await this.store.attestingFile(fileId)) {
+            const subject = { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId };
+            if (await this.recordNamesSeal(subject, seal._id))
+                return { sealId: seal._id, seal, subject };
+        }
+        for (const retained of await this.store.retainedAttestingFile(fileId)) {
+            const subject = { resourceType: retained.resourceType, resourceId: retained.resourceId };
+            if (await this.recordNamesSeal(subject, retained.sealId))
+                return { sealId: retained.sealId, seal: null, subject };
+        }
+        return null;
+    }
+    /**
+     * Whether the record a seal is about names it: the consumer stores a seal's id when the approved effect happens (a
+     * close's `signOffApprovalSealId`, or the reopening that set it aside), so a seal no field of its record names approved
+     * nothing that took effect. Read as the system; nothing of the record leaves.
+     */
+    async recordNamesSeal(subject, sealId) {
+        const resourceType = subject.resourceType;
+        if (!this.resourceIsRegistered(resourceType))
+            return false;
+        const record = await this.repositoriesRegistry.readUnscopedByKey(resourceType, { _id: subject.resourceId });
+        return record !== null && valueNamesId(record, sealId, RECORD_SEAL_REFERENCE_DEPTH);
+    }
+    fileNotFound(fileId) {
+        return this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+            customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND, context: { fileId },
+        });
+    }
+    /** Whether the registry knows a resource type, asked without letting an unknown name throw a 500. */
+    resourceIsRegistered(resourceType) {
+        try {
+            return !!this.resourcesRegistry.getResourceConfiguration(resourceType);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The approval's currency over its record (#2914), as the operator's door computes it. Undefined when it cannot be
+     * asked here (the presentation cannot be read, or no system access is bound): the view then says nothing about
+     * currency, which is never read as current.
+     */
+    async currencyOf(seal) {
+        const systemAccess = this.systemAccess;
+        if (!systemAccess)
+            return undefined;
+        const read = await readApprovalSealPresentation(seal, {
+            readFileRow: (fileId) => this.store.readFile(fileId), files: this.files, contexts: this.executionContextCreator,
+        });
+        if (read.outcome === ApprovalSealPresentationReadOutcome.TAMPERED || read.outcome === ApprovalSealPresentationReadOutcome.UNREADABLE) {
+            this.logger.error('[ApprovalSeals] A seal\'s presentation could not be read for its record\'s view; its currency is not shown', {
+                sealId: seal._id, fileId: read.fileId, outcome: read.outcome, ...(read.outcome === ApprovalSealPresentationReadOutcome.UNREADABLE ? { reason: read.reason } : {}),
+            });
+            return undefined;
+        }
+        try {
+            return await assessApprovalSealCurrency(seal, read.outcome === ApprovalSealPresentationReadOutcome.CONTENT ? read.content : undefined, {
+                readRecord: (resourceType, resourceId) => systemAccess.readAsSystem(resourceType, { _id: resourceId }, { suppressSystemAudit: true })
+                    .catch((error) => {
+                    if (isWildoBackendError(error) && error.type === ErrorType.NOT_FOUND)
+                        return null;
+                    throw error;
+                }),
+            });
+        }
+        catch (error) {
+            this.logger.error('[ApprovalSeals] A seal\'s currency could not be computed for its record\'s view; it is not shown', { sealId: seal._id, error: describeCaughtError(error) });
+            return undefined;
+        }
+    }
+    /** The `files` row of the copy a seal names, when it is linked to the seal and servable; null otherwise. */
+    async servableCopyRow(seal) {
+        const copy = seal.manifestedCopy;
+        const fileId = copy !== null && typeof copy === 'object' ? copy.fileId : undefined;
+        if (typeof fileId !== 'string')
+            return null;
+        const row = await this.store.readFile(fileId);
+        return row && row.linkedResourceId === seal._id && FILE_DOWNLOADABLE_STATUSES.has(row.status) ? row : null;
+    }
+    async manifestedCopyServable(seal) {
+        return seal.status === ApprovalSealStatus.SEALED && !!this.files && (await this.servableCopyRow(seal)) !== null;
+    }
+    notFound(params, reason) {
+        return this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+            customMessageReference: ErrorCustomMessageReference.NOT_FOUND, context: { reason, sealId: params.sealId },
+        });
+    }
+};
+ApprovalSealsOnRecordControllerBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ErrorHandlerService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.ResourceRegistryService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.AuthorizationsService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
+    __param(7, optional()),
+    __param(8, inject(SAAS_SERVICE_TYPES.FilesBackendService)),
+    __param(8, optional()),
+    __param(9, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(9, optional()),
+    __param(10, inject(SAAS_SERVICE_TYPES.FileFieldDetectionService)),
+    __param(10, optional()),
+    __metadata("design:paramtypes", [LoggerService,
+        ErrorBuilderBackendService,
+        ErrorHandlerService,
+        RepositoriesRegistryHandlerBackendService, Function, Function, Function, Object, Object, Object, Function])
+], ApprovalSealsOnRecordControllerBackendService);
+export { ApprovalSealsOnRecordControllerBackendService };
+//# sourceMappingURL=approval-seals-on-record.backend.controller.js.map

package/dist/esm/compliance/approval-seals/approval-seals-on-record.backend.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seals-on-record.backend.controller.js","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seals-on-record.backend.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,0BAA0B,EAC1B,UAAU,EACV,wBAAwB,EAExB,mBAAmB,GAOpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAOhK,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AACvI,OAAO,EAAE,sBAAsB,EAAyB,MAAM,2DAA2D,CAAC;AAE1H,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,mCAAmC,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAC9H,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAE/E,qHAAqH;AACrH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,IAAI,KAAK,IAAI,OAAQ,KAAkC,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1I,OAAQ,KAAuC,CAAC,WAAW,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAEtC,sFAAsF;AACtF,SAAS,YAAY,CAAC,KAAc,EAAE,EAAU,EAAE,KAAa;IAC7D,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC;IACrG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAkBM,IAAM,6CAA6C,GAAnD,MAAM,6CAA8C,SAAQ,gCAAgC;IAOf;IACX;IACc;IAChB;IAEU;IAEA;IACH;IAES;IAhBpE,KAAK,CAAyB;IAE/C,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EACD,oBAA+D,EAC1E,iBAAkD,EACpC,uBAA8D,EAC9E,qBAAmD,EAEzC,YAA+D,EAE/D,KAAkD,EACrD,SAAqE,EAE5D,kBAAqD;QAExI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,iCAAiC,CAAC,CAAC;QAZG,yBAAoB,GAApB,oBAAoB,CAA2C;QAC1E,sBAAiB,GAAjB,iBAAiB,CAAiC;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC9E,0BAAqB,GAArB,qBAAqB,CAA8B;QAEzC,iBAAY,GAAZ,YAAY,CAAmD;QAE/D,UAAK,GAAL,KAAK,CAA6C;QACrD,cAAS,GAAT,SAAS,CAA4D;QAE5D,uBAAkB,GAAlB,kBAAkB,CAAmC;QAGxI,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;IAChE,CAAC;IAES,WAAW;QACnB,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACjI,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,uCAAuC,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3J,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,qBAAqB,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACnI,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,qCAAqC,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7J,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7I,CAAC;IAED,8DAA8D;IACtD,KAAK,CAAC,UAAU,CAAC,GAAY,EAAE,GAAa;QAClD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1I,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,uGAAuG;IAC/F,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC,CAAC;IACtH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpG,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,wBAAwB,CAAC,GAAY,EAAE,GAAa;QAChE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAC1D,MAAM,EAAE,WAAW,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAI,gBAAgB,CAAC,YAAgD,EAAE,MAAM,CAAC;QAC1F,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;YACzF,sBAAsB,EAAE,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE,WAAW,EAAE;SACvI,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1I,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,MAAM,CAClB,MAAc,EACd,IAAyB,EACzB,QAAiB,EACjB,OAAuE,EACvE,YAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,sBAAsB,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtF,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE;YACjF,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,SAAS;YACxF,CAAC,CAAC,SAAS,CAAC,CAAC;QACf,OAAO,0BAA0B,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB;YACzD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,kBAAkB,CAAC,IAAyB,EAAE,GAAa,EAAE,QAAuB;QAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,QAAQ,EAAE,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAA0B,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6FAA6F,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/J,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE;aAC9I,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,kCAAkC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACxF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,KAAK,CAAC,GAAY;QAC9B,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI;YAClB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE;YAC9E,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC3H,MAAM,YAAY,GAAG,MAAM,CAAC,YAA4B,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACpF,8GAA8G;QAC9G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAA0B,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACrI,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,aAAa,CAAC,oBAA4C,CAAC;QAChF,MAAM,2BAA2B,CAAC,GAAG,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY;YACZ,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,IAAI;YAC1D,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI;SAC3C,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE;YAC3D,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC1F,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SACzG,EAAE,QAAQ,CAAC,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CAAC,GAAY;QAClC,MAAM,EAAE,MAAM,EAAE,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,sBAAsB,CAAC,OAA0B,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE;YAC1C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC1F,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACxG,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC7E,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7F,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzF,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,OAAuE,EAAE,MAAc;QACnH,MAAM,YAAY,GAAG,OAAO,CAAC,YAA4B,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAA0B,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACrI,OAAO,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACtF,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;YAClE,sBAAsB,EAAE,2BAA2B,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,qGAAqG;IAC7F,oBAAoB,CAAC,YAA0B;QACrD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,IAAkB;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE;YACpD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,uBAAuB;SAChH,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,OAAO,KAAK,mCAAmC,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,mCAAmC,CAAC,UAAU,EAAE,CAAC;YACrI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4GAA4G,EAAE;gBAC9H,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,mCAAmC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClK,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,mCAAmC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE;gBACrI,UAAU,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAA0B,YAA4B,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAW,CAAC;qBACpL,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxB,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS;wBAAE,OAAO,IAAI,CAAC;oBAClF,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kGAAkG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/K,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,4GAA4G;IACpG,KAAK,CAAC,eAAe,CAAC,IAAkB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAyB,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3H,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAkB;QACrD,OAAO,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IAClH,CAAC;IAEO,QAAQ,CAAC,MAAkD,EAAE,MAAc;QACjF,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;YAClE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAC1G,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/QY,6CAA6C;IADzD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAEhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAE1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAC1D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;IAEvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;qCAbtB,aAAa;QACM,0BAA0B;QAC1B,mBAAmB;QACqB,yCAAyC;GAPtI,6CAA6C,CA+QzD","sourcesContent":["/**\n * # The record's view of its approval seal (#2913)\n *\n * - `GET /approval-seals/:sealId/records/:resourceType/:resourceId/:field` → how the record shows the seal its `field`\n *   stores: who approved, when, with which meaning, whether it is still current over the record, its deliverable.\n * - `…/manifested-copy` → the deliverable's manifested copy (#2907), as a PDF.\n * - `GET /approval-seals/files/:fileId` (+ `/manifested-copy`) → the seal that attests a FILE, the deliverable a person\n *   approved by its hash: admitted through the READ of the record the file belongs to (the files door's own\n *   `authorizeFileParentRead`, itself `authorizeRecordReadAsCaller`), and only for a seal its own record still names.\n * - `GET /approval-seals/decisions/:decisionRef` → the seal of the signed-in person's own answer to a decision, for the\n *   decision cards and the inbox: the decider reads the seal of their act, nobody else.\n *\n * ## Who is admitted, and to what\n *\n * Exactly the callers the RECORD's own READ operation admits, with their own credentials, through the routes that\n * operation declares (`authorizeRecordReadAsCaller`, the admission a file in a record's field already uses). On top of\n * that, three facts must hold, and any that does not answers the same 404 as a record that does not exist:\n *\n * 1. the record's `field` holds the seal's id: a seal is shown only where the consumer stored it, which it does when the\n *    approved effect happened, so a seal whose effect failed (a close that moved while it was being signed) never reads\n *    as approving the record;\n * 2. the seal is ABOUT that record (`linkedResourceType` / `linkedResourceId`): a field cannot be pointed at another\n *    record's seal;\n * 3. for the copy, the seal still owns a servable copy whose bytes match the hash recorded for them.\n *\n * Read-only, and nothing is recorded on the trail: the view hands the record's reader the approver's printed name, which\n * a record that stores a decider (`closes.signedOffByUserId`) already shows them, and the record's own READ is the\n * access decision. Currency names fields, never values.\n *\n * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — the person's approval of a record is shown where the record is read, with whether it still describes the record, computed from the seal, never assumed.\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a seal is shown only to a caller the record's own READ admits, and only for the seal that record stores.\n */\nimport { createHash } from 'crypto';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Request, Response } from 'express';\nimport {\n  ApprovalSealOfDecisionParamsSchema,\n  ApprovalSealOnFileParamsSchema,\n  ApprovalSealOnRecordParamsSchema,\n  ApprovalSealStatus,\n  BackendApiType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  FILE_DOWNLOADABLE_STATUSES,\n  HttpMethod,\n  ManualControllerRouteKey,\n  ResourcePrimaryScope,\n  isWildoBackendError,\n  type ApprovalSeal,\n  type ApprovalSealOnRecordParams,\n  type ApprovalSealSubjectCurrencyAssessment,\n  type File,\n  type FileStatus,\n  type ResourceType,\n} from '@wildo-ai/saas-models';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { FilesBackendService } from '~wildo-backend-lib/files/services/files.backend.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { authorizeFileParentRead, authorizeRecordReadAsCaller } from '~wildo-backend-lib/files/utils/file-parent-read-context.backend';\nimport { createFileShareBinding, type FileShareBinding } from '~wildo-backend-lib/files/utils/file-share-binding.backend';\nimport type { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { ApprovalSealRelayStore } from './approval-seal-relay-store.backend';\nimport { assessApprovalSealCurrency } from './approval-seal-currency.backend';\nimport { ApprovalSealPresentationReadOutcome, readApprovalSealPresentation } from './approval-seal-presentation-read.backend';\nimport { approvalSealPublicCheckUrlOf } from './approval-seal-public-check.backend';\nimport { approvalSealOnRecordViewOf } from './approval-seal-on-record.backend';\n\n/** A stored id as a string: ids are strings in SQL and ObjectIds in Mongo, and a populated object is never an id. */\nfunction storedIdOf(value: unknown): string | undefined {\n  if (typeof value === 'string') return value;\n  if (value && typeof value === 'object' && 'toHexString' in value && typeof (value as { toHexString: unknown }).toHexString === 'function') {\n    return (value as { toHexString: () => string }).toHexString();\n  }\n  return undefined;\n}\n\n/**\n * How deep in a record a seal's id is looked for: a top-level field (`signOffApprovalSealId`), or a member of an entry of\n * a top-level array (`reopenings[].previousSignOffApprovalSealId`). Bounded, so a record's size bounds the search.\n */\nconst RECORD_SEAL_REFERENCE_DEPTH = 2;\n\n/** Whether a stored value names `id`, within `depth` levels of objects and arrays. */\nfunction valueNamesId(value: unknown, id: string, depth: number): boolean {\n  if (storedIdOf(value) === id) return true;\n  if (depth <= 0 || value === null || typeof value !== 'object' || value instanceof Date) return false;\n  const members = Array.isArray(value) ? value : Object.values(value as Record<string, unknown>);\n  return members.some((member) => valueNamesId(member, id, Array.isArray(value) ? depth : depth - 1));\n}\n\n/** The seal that attests a file and that its record names; `seal` is null for one its approver's erasure retained. */\ninterface AttestingSeal {\n  readonly sealId: string;\n  readonly seal: ApprovalSeal | null;\n  readonly subject: { readonly resourceType: string; readonly resourceId: string };\n}\n\n/** The seal a request asks about, found and checked against the record it names; see the file header. */\ninterface AdmittedSeal {\n  readonly params: ApprovalSealOnRecordParams;\n  /** The live seal; null when it is retained after its approver's erasure. */\n  readonly seal: ApprovalSeal | null;\n  readonly retained: boolean;\n}\n\n@injectable()\nexport class ApprovalSealsOnRecordControllerBackendService extends AbstractControllerBackendService {\n  private readonly store: ApprovalSealRelayStore;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n    @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) private readonly resourcesRegistry: ResourcesRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthorizationsService) private readonly authorizationsService: AuthorizationsBackendService,\n    /** The currency check reads the record as the system, as the operator's door does, so both compare the same values. */\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) @optional() private readonly systemAccess?: Pick<SystemAccessBackendService, 'readAsSystem'>,\n    /** A presentation moved to a frozen file, and the manifested copy, are read through the files service. */\n    @inject(SAAS_SERVICE_TYPES.FilesBackendService) @optional() private readonly files?: Pick<FilesBackendService, 'readFileBytes'>,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) @optional() private readonly appConfig?: Pick<AppConfigurationService, 'config' | 'isInitialized'>,\n    /** A file's view admits its reader through the files door's own check of the field the file is in. */\n    @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService) @optional() private readonly fileFieldDetection?: FileFieldDetectionBackendService,\n  ) {\n    super(logger, errorBuilder, errorHandler, 'ApprovalSealsOnRecordController');\n    this.store = new ApprovalSealRelayStore(repositoriesRegistry);\n  }\n\n  protected setupRoutes(): void {\n    this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_RECORD, HttpMethod.GET, (req, res) => this.handleView(req, res));\n    this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_RECORD_MANIFESTED_COPY, HttpMethod.GET, (req, res) => this.handleManifestedCopy(req, res));\n    this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_FILE, HttpMethod.GET, (req, res) => this.handleFileView(req, res));\n    this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_ON_FILE_MANIFESTED_COPY, HttpMethod.GET, (req, res) => this.handleFileManifestedCopy(req, res));\n    this.mountManualRoute(ManualControllerRouteKey.APPROVAL_SEAL_OF_DECISION, HttpMethod.GET, (req, res) => this.handleDecisionView(req, res));\n  }\n\n  /** GET …/:field — the record's view of the seal it stores. */\n  private async handleView(req: Request, res: Response): Promise<void> {\n    const { params, seal, retained } = await this.admit(req);\n    const view = await this.viewOf(params.sealId, seal, retained, { resourceType: params.resourceType, resourceId: params.resourceId }, true);\n    res.set('Cache-Control', 'no-store');\n    res.json(view);\n  }\n\n  /** GET …/:field/manifested-copy — the copy, checked against its recorded hash before a byte leaves. */\n  private async handleManifestedCopy(req: Request, res: Response): Promise<void> {\n    const { params, seal } = await this.admit(req);\n    await this.sendManifestedCopy(seal, res, () => this.notFound(params, 'approval_seal_manifested_copy_not_servable'));\n  }\n\n  /**\n   * GET /approval-seals/files/:fileId — the seal that attests a file (#2913): the deliverable a person approved by its hash.\n   * Without currency, which is a statement about the record the approval is about, and which a reader of the file may not\n   * be able to read.\n   */\n  private async handleFileView(req: Request, res: Response): Promise<void> {\n    const { found } = await this.admitFile(req);\n    const view = await this.viewOf(found.sealId, found.seal, found.seal === null, found.subject, false);\n    res.set('Cache-Control', 'no-store');\n    res.json(view);\n  }\n\n  /** GET /approval-seals/files/:fileId/manifested-copy — that file's manifested copy. */\n  private async handleFileManifestedCopy(req: Request, res: Response): Promise<void> {\n    const { fileId, found } = await this.admitFile(req);\n    await this.sendManifestedCopy(found.seal, res, () => this.fileNotFound(fileId));\n  }\n\n  /**\n   * GET /approval-seals/decisions/:decisionRef — the seal of the signed-in person's own answer to a decision (#2913). The\n   * person who decided may always see the seal of their act (it is in their subject export); nobody else is answered.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a decision's seal is answered to the person who decided, and to nobody else through this door.\n   */\n  private async handleDecisionView(req: Request, res: Response): Promise<void> {\n    const { decisionRef } = ApprovalSealOfDecisionParamsSchema.parse(req.params);\n    const executionContext = await this.executionContextCreator.createExecutionContextForManualController(req);\n    const userId = (executionContext.initiatorIds as { userId?: string } | undefined)?.userId;\n    const notFound = () => this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.NOT_FOUND, context: { reason: 'approval_seal_of_decision_not_found', decisionRef },\n    });\n    if (!userId) throw notFound();\n    const seal = await this.store.latestOfDecisionBy(decisionRef, userId);\n    if (!seal) throw notFound();\n    const view = await this.viewOf(seal._id, seal, false, { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId }, true);\n    res.set('Cache-Control', 'no-store');\n    res.json(view);\n  }\n\n  /** What a reader is told about one seal: its successor, its currency when asked for, its copy, its public check. */\n  private async viewOf(\n    sealId: string,\n    seal: ApprovalSeal | null,\n    retained: boolean,\n    subject: { readonly resourceType: string; readonly resourceId: string },\n    withCurrency: boolean,\n  ): Promise<ReturnType<typeof approvalSealOnRecordViewOf>> {\n    const successor = seal ? await this.store.successorOf(sealId, subject) : null;\n    const currency = seal && withCurrency ? await this.currencyOf(seal) : undefined;\n    const manifestedCopyServable = seal ? await this.manifestedCopyServable(seal) : false;\n    const publicCheckUrl = approvalSealPublicCheckUrlOf(this.appConfig?.isInitialized()\n      ? this.appConfig.config.runtime?.endPoints?.[BackendApiType.MAIN_BACKEND_API]?.publicUrl\n      : undefined);\n    return approvalSealOnRecordViewOf({\n      sealId, seal, retained, successor, manifestedCopyServable,\n      ...(currency ? { currency } : {}), ...(publicCheckUrl ? { publicCheckUrl } : {}),\n    });\n  }\n\n  /** Send a SEALED seal's manifested copy, checked against its recorded hash before a byte leaves. */\n  private async sendManifestedCopy(seal: ApprovalSeal | null, res: Response, notFound: () => unknown): Promise<void> {\n    if (!seal || seal.status !== ApprovalSealStatus.SEALED || !this.files) throw notFound();\n    const fileRow = await this.servableCopyRow(seal);\n    if (!fileRow) throw notFound();\n    const context = await this.executionContextCreator.createForInternalSystemOperation();\n    const bytes = await this.files.readFileBytes(fileRow as unknown as File, context);\n    const recorded = typeof fileRow.contentSha256 === 'string' ? fileRow.contentSha256 : undefined;\n    if (!recorded || createHash('sha256').update(bytes).digest('hex') !== recorded) {\n      this.logger.error('[ApprovalSeals] A manifested copy does not match the hash recorded for it; it is not served', { sealId: seal._id, fileId: fileRow.fileId });\n      throw this.errorBuilder.buildError(ErrorType.CONFLICT, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFLICT, context: { reason: 'approval_seal_manifested_copy_mismatch', sealId: seal._id },\n      });\n    }\n    res.setHeader('Content-Type', 'application/pdf');\n    res.setHeader('Content-Disposition', `attachment; filename=\"approval-${seal._id}.pdf\"`);\n    res.setHeader('Cache-Control', 'no-store');\n    res.setHeader('X-Content-Type-Options', 'nosniff');\n    res.end(bytes);\n  }\n\n  /**\n   * Find the seal, check it is about the record the request names, and admit the caller through that record's READ, the\n   * record's field holding the seal's id. Every refusal is the same 404.\n   */\n  private async admit(req: Request): Promise<AdmittedSeal> {\n    const params = ApprovalSealOnRecordParamsSchema.parse(req.params);\n    const notFound = () => this.notFound(params, 'approval_seal_not_shown_on_record');\n    const seal = await this.store.read(params.sealId);\n    const subject = seal\n      ? { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId }\n      : await this.store.retainedSubjectOf(params.sealId);\n    if (!subject || subject.resourceType !== params.resourceType || subject.resourceId !== params.resourceId) throw notFound();\n    const resourceType = params.resourceType as ResourceType;\n    if (!this.resourceIsRegistered(resourceType)) throw notFound();\n    const configuration = this.resourcesRegistry.getResourceConfiguration(resourceType);\n    // The scope the record lives in, from the record itself: it only shapes the routes its READ is tried through.\n    const located = await this.repositoriesRegistry.readUnscopedByKey<Record<string, unknown>>(resourceType, { _id: params.resourceId });\n    if (!located) throw notFound();\n    const primaryScope = configuration.resourcePrimaryScope as ResourcePrimaryScope;\n    await authorizeRecordReadAsCaller(req, {\n      resourceType: params.resourceType,\n      resourceId: params.resourceId,\n      primaryScope,\n      applicationId: storedIdOf(located.applicationId) ?? (seal ? String(seal.applicationId) : ''),\n      organizationId: storedIdOf(located.organizationId) ?? null,\n      userId: storedIdOf(located.userId) ?? null,\n    }, (row) => storedIdOf(row[params.field]) === params.sealId, {\n      resourcesRegistry: this.resourcesRegistry, repositoriesRegistry: this.repositoriesRegistry,\n      executionContextCreator: this.executionContextCreator, authorizationsService: this.authorizationsService,\n    }, notFound);\n    return { params, seal, retained: !seal };\n  }\n\n  /**\n   * The seal that attests a file and that its own record still names, then the caller admitted through the READ of the\n   * record the FILE belongs to (`authorizeFileParentRead`, over `authorizeRecordReadAsCaller`). A live seal first, latest\n   * decision first; then one its approver's erasure retained, known by id and subject only. A seal its record does not\n   * name (an approved effect that failed) is passed over. Every refusal is the same 404, the files door's.\n   */\n  private async admitFile(req: Request): Promise<{ readonly fileId: string; readonly found: AttestingSeal }> {\n    const { fileId } = ApprovalSealOnFileParamsSchema.parse(req.params);\n    const found = await this.attestingSealOf(fileId);\n    if (!found || !this.fileFieldDetection) throw this.fileNotFound(fileId);\n    const fileRow = await this.store.readFile(fileId);\n    let binding: FileShareBinding;\n    try {\n      binding = createFileShareBinding(fileRow as unknown as File);\n    } catch {\n      throw this.fileNotFound(fileId);\n    }\n    await authorizeFileParentRead(req, binding, {\n      resourcesRegistry: this.resourcesRegistry, repositoriesRegistry: this.repositoriesRegistry,\n      executionContextCreator: this.executionContextCreator, authorizationsService: this.authorizationsService,\n      errorBuilder: this.errorBuilder, fileFieldDetection: this.fileFieldDetection,\n    });\n    return { fileId, found };\n  }\n\n  private async attestingSealOf(fileId: string): Promise<AttestingSeal | null> {\n    for (const seal of await this.store.attestingFile(fileId)) {\n      const subject = { resourceType: seal.linkedResourceType, resourceId: seal.linkedResourceId };\n      if (await this.recordNamesSeal(subject, seal._id)) return { sealId: seal._id, seal, subject };\n    }\n    for (const retained of await this.store.retainedAttestingFile(fileId)) {\n      const subject = { resourceType: retained.resourceType, resourceId: retained.resourceId };\n      if (await this.recordNamesSeal(subject, retained.sealId)) return { sealId: retained.sealId, seal: null, subject };\n    }\n    return null;\n  }\n\n  /**\n   * Whether the record a seal is about names it: the consumer stores a seal's id when the approved effect happens (a\n   * close's `signOffApprovalSealId`, or the reopening that set it aside), so a seal no field of its record names approved\n   * nothing that took effect. Read as the system; nothing of the record leaves.\n   */\n  private async recordNamesSeal(subject: { readonly resourceType: string; readonly resourceId: string }, sealId: string): Promise<boolean> {\n    const resourceType = subject.resourceType as ResourceType;\n    if (!this.resourceIsRegistered(resourceType)) return false;\n    const record = await this.repositoriesRegistry.readUnscopedByKey<Record<string, unknown>>(resourceType, { _id: subject.resourceId });\n    return record !== null && valueNamesId(record, sealId, RECORD_SEAL_REFERENCE_DEPTH);\n  }\n\n  private fileNotFound(fileId: string): unknown {\n    return this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n      customMessageReference: ErrorCustomMessageReference.FILE_NOT_FOUND, context: { fileId },\n    });\n  }\n\n  /** Whether the registry knows a resource type, asked without letting an unknown name throw a 500. */\n  private resourceIsRegistered(resourceType: ResourceType): boolean {\n    try {\n      return !!this.resourcesRegistry.getResourceConfiguration(resourceType);\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * The approval's currency over its record (#2914), as the operator's door computes it. Undefined when it cannot be\n   * asked here (the presentation cannot be read, or no system access is bound): the view then says nothing about\n   * currency, which is never read as current.\n   */\n  private async currencyOf(seal: ApprovalSeal): Promise<ApprovalSealSubjectCurrencyAssessment | undefined> {\n    const systemAccess = this.systemAccess;\n    if (!systemAccess) return undefined;\n    const read = await readApprovalSealPresentation(seal, {\n      readFileRow: (fileId) => this.store.readFile(fileId), files: this.files, contexts: this.executionContextCreator,\n    });\n    if (read.outcome === ApprovalSealPresentationReadOutcome.TAMPERED || read.outcome === ApprovalSealPresentationReadOutcome.UNREADABLE) {\n      this.logger.error('[ApprovalSeals] A seal\\'s presentation could not be read for its record\\'s view; its currency is not shown', {\n        sealId: seal._id, fileId: read.fileId, outcome: read.outcome, ...(read.outcome === ApprovalSealPresentationReadOutcome.UNREADABLE ? { reason: read.reason } : {}),\n      });\n      return undefined;\n    }\n    try {\n      return await assessApprovalSealCurrency(seal, read.outcome === ApprovalSealPresentationReadOutcome.CONTENT ? read.content : undefined, {\n        readRecord: (resourceType, resourceId) => systemAccess.readAsSystem<Record<string, unknown>>(resourceType as ResourceType, { _id: resourceId }, { suppressSystemAudit: true } as never)\n          .catch((error: unknown) => {\n            if (isWildoBackendError(error) && error.type === ErrorType.NOT_FOUND) return null;\n            throw error;\n          }),\n      });\n    } catch (error) {\n      this.logger.error('[ApprovalSeals] A seal\\'s currency could not be computed for its record\\'s view; it is not shown', { sealId: seal._id, error: describeCaughtError(error) });\n      return undefined;\n    }\n  }\n\n  /** The `files` row of the copy a seal names, when it is linked to the seal and servable; null otherwise. */\n  private async servableCopyRow(seal: ApprovalSeal): Promise<Record<string, unknown> | null> {\n    const copy = seal.manifestedCopy as unknown;\n    const fileId = copy !== null && typeof copy === 'object' ? (copy as { fileId?: unknown }).fileId : undefined;\n    if (typeof fileId !== 'string') return null;\n    const row = await this.store.readFile(fileId);\n    return row && row.linkedResourceId === seal._id && FILE_DOWNLOADABLE_STATUSES.has(row.status as FileStatus) ? row : null;\n  }\n\n  private async manifestedCopyServable(seal: ApprovalSeal): Promise<boolean> {\n    return seal.status === ApprovalSealStatus.SEALED && !!this.files && (await this.servableCopyRow(seal)) !== null;\n  }\n\n  private notFound(params: Pick<ApprovalSealOnRecordParams, 'sealId'>, reason: string): unknown {\n    return this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n      customMessageReference: ErrorCustomMessageReference.NOT_FOUND, context: { reason, sealId: params.sealId },\n    });\n  }\n}\n"]}

package/dist/esm/compliance/approval-seals/decision-presentation.backend.d.ts

@@ -1,4 +1,4 @@
-import { HumanDecision_SentCardContent, type HumanDecision_Answer, type HumanDecision_PendingCard, type HumanDecision_Presentation, type ApprovalSealRecordPresentation, type HumanDecision_PresentedDeliverable, type HumanDecision_SealedPresentation, type HumanDecision_Statement, type HumanDecisionPresentationSource } from '@wildo-ai/saas-models';
+import { HumanDecision_SentCardContent, type HumanDecision_Answer, type HumanDecision_PendingCard, type HumanDecision_Presentation, type ApprovalSealRecordPresentation, type HumanDecision_PresentedDeliverable, type HumanDecision_PresentedRecord, type HumanDecision_SealedPresentation, type HumanDecision_Statement, type HumanDecisionPresentationSource } from '@wildo-ai/saas-models';
 import type { AppConfigurationService } from '../../config/services/app-configuration.backend.service';
 /**
  * Domain separation for the presentation-id key, derived from the decision-presentation purpose key (#2893; until then,
@@ -22,7 +22,9 @@ export declare function decisionPresentationIdOf(presentation: HumanDecision_Pre
  * {@link resolveDecisionDeliverables}, joins the presentation and only the presentation: the card has no field of its own
  * for it, so nothing reads it anywhere but where the id covers it.
  */
-export declare function withDecisionPresentation<TCard extends HumanDecisionPresentationSource>(card: TCard, key: Buffer, deliverables?: readonly HumanDecision_PresentedDeliverable[]): TCard & Required<Pick<HumanDecision_PendingCard, 'presentation' | 'presentationId'>>;
+export declare function withDecisionPresentation<TCard extends HumanDecisionPresentationSource>(card: TCard, key: Buffer, deliverables?: readonly HumanDecision_PresentedDeliverable[], 
+/** #2914: the record the call acts on, with the fields its approval covers ({@link resolveDecisionSubjectRecord}). */
+subjectRecord?: HumanDecision_PresentedRecord): TCard & Required<Pick<HumanDecision_PendingCard, 'presentation' | 'presentationId'>>;
 /**
  * Domain separation for a file deliverable's salt (#2904), derived under the presentation-id key.
  *
@@ -88,6 +90,31 @@ export declare function resolveDecisionDeliverables(params: {
     /** Told when a read failed, so a NOT_BOUND that hides an outage is still seen. */
     readonly onReadFailure?: (error: unknown) => void;
 }): Promise<ResolvedDecisionDeliverables>;
+/**
+ * The record a tool approval is about, with the fields its tool declares the approval covers (#2914,
+ * `FunctionTool.sealedRecordFields`): the row named by the call's `rowIdArgument`, read as the system when the card is
+ * built, its declared values projected like presented arguments. The announcement, the history, the inbox and the act all
+ * resolve it here, so they agree on the presentation and its id: a card read before one of those values changed carries
+ * another id, and its answer is refused as stale.
+ *
+ * Undefined, never a guess, when the tool declares no field set, the call names no row, the row cannot be read, or the
+ * row belongs to another organization than the decision (a card must not show another tenant's values). Each reads
+ * alike, so the card discloses nothing about a row its reader may not see.
+ *
+ * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — the record values an approval covers are shown to the person and sealed with their answer, so whether the approval still holds can be computed later.
+ */
+export declare function resolveDecisionSubjectRecord(params: {
+    readonly sealedFields: readonly string[] | undefined;
+    readonly resourceType: string | undefined;
+    readonly rowIdArgument: string | undefined;
+    readonly toolArgs: Readonly<Record<string, unknown>> | undefined;
+    /** The organization the decision belongs to; absent for a decision of the application. */
+    readonly organizationId?: string;
+    /** Reads the row as the system; null when there is none. */
+    readonly readRow: (resourceType: string, rowId: string) => Promise<Readonly<Record<string, unknown>> | null>;
+    /** Told when a read failed, so an absent record that hides an outage is still seen. */
+    readonly onReadFailure?: (error: unknown) => void;
+}): Promise<HumanDecision_PresentedRecord | undefined>;
 /** The presentation a seal binds: what was built, its id when one could be derived, and how its rendering is known. */
 export type SealedDecisionPresentation = HumanDecision_SealedPresentation;
 /** What checking an answer's echoed presentation came to. */